TW201630378A - Key splitting - Google Patents

Abstract

According to an example, key splitting may include utilizing a masked version of a master key that is masked by using a mask.

Description

Key splitting technique

The present invention relates to a key splitting technique.

Background of the invention

Encryption is a method of encoding information such that the encrypted information is read by an authorized entity. As for encryption, information that is typically referred to as plaintext is encrypted using an encryption method. Encrypted information is called ciphertext. To read the ciphertext, a key is typically used to decrypt the ciphertext.

In accordance with an embodiment of the present invention, it is specifically proposed that a non-transitory computer readable medium has stored thereon machine readable instructions for providing key splitting, the machine readable instructions being at least one executed when executed The processor is configured to: generate a primary key; generate a random mask; generate a masked version of the primary key by using the random mask; forward the masked version of the primary key to a key management Responding to the masked version of the master key, receiving a new mask from the key manager; and determining a data key based on the new mask and the random mask.

100‧‧‧Key Split System

102‧‧‧Data processing case generation module

104‧‧‧Data processing case

106‧‧‧ Data owner

108‧‧‧Master Key

110‧‧‧Virtual Key Management Module

112‧‧‧Data repository

114‧‧‧Information

116‧‧‧Data Repository Key Generation Module

118‧‧‧ Data Processing Case Key Generation Module

120‧‧‧Previous storage item retrieval module

122‧‧‧ Random mask

200‧‧‧ Data Processing Case Generation Agreement

202-212, 302-314, 402-414, 502-514, 602-612, 702-712‧‧‧ blocks

300‧‧‧Data Repository Key Generation Agreement

400‧‧‧ Data Processing Case Key Generation Agreement

500‧‧‧Previous storage item retrieval agreement

600, 700‧‧‧ method

800‧‧‧ computer system

802‧‧‧ processor

804‧‧‧Communication bus

806‧‧‧ main memory

808‧‧‧Secondary data storage device

810‧‧‧I/O device

812‧‧‧Internet interface

820‧‧‧Key Splitting Module

The features disclosed herein are illustrated by the following figures and are not limiting. And similar elements in the drawings indicate similar elements. In the drawings: Figure 1 illustrates the architecture of a key splitting system in accordance with one embodiment disclosed herein; Figure 2 illustrates the gold used in Figure 1 in accordance with one embodiment disclosed herein. A data processing case generation protocol flow diagram of a key splitting system; FIG. 3 illustrates a flow chart of a data repository key generation agreement for the key splitting system of FIG. 1 in accordance with one embodiment disclosed herein; FIG. 4 illustrates A flowchart of a data processing case key generation agreement for the key splitting system of FIG. 1 is disclosed herein; FIG. 5 illustrates a prior use for the key splitting system of FIG. 1 in accordance with an embodiment disclosed herein A flowchart of a stored object retrieval protocol; FIG. 6 illustrates a key splitting method in accordance with one embodiment of the present disclosure; FIG. 7 illustrates further details of the key splitting method in accordance with one embodiment disclosed herein; and FIG. 8 illustrates One embodiment is disclosed in a computer system.

Detailed description of the preferred embodiment

For the purposes of brevity and illustration, the disclosure herein is primarily described with reference to the examples. In the detailed description that follows, numerous specific details are set forth to provide a thorough understanding of the disclosure herein. However, it is apparent that the specific details are not limited to the specific details disclosed herein. In other instances, several methods and structures are not described in detail to avoid unnecessarily obscuring the disclosure herein.

Throughout the text, the words "a" and "an" are intended to mean at least one of the specified elements. As used herein, the term "comprising" means including but not limiting, and the term "including" includes, but is not limiting. The term "based on" is based at least in part on.

The symmetry key used for encryption and decryption of data typically includes both the encryption of the plaintext and the decryption of the ciphertext using the same cryptographic key. As for the symmetry keys, the keys are typically the same or may be transformed between the two keys. The asymmetric key used for encryption and decryption of data typically includes two separate keys, one of which is secret (or dedicated) and one of which is public. As for the encryption and decryption of data, the key splitting typically involves a key splitting or decryption process divided into two or more parts, so if the key is not reconstructed by unifying all the parts, then any part itself cannot be used. .

The authentication process may include the process of determining whether the received material is the transmitted material. The authentication process may also include authenticity by using, for example, hash-based message authentication (HMAC) authentication data, and other verification techniques.

Key management may include encryption, decryption, or authentication for data, and/or key management for generating additional keys. For example, for key management, the collection of individual master keys and their corresponding encrypted data items can be placed under the control of a single data owner. This type of key management can be used as part of a computing system that provides cryptographic services using symmetric key cryptography mechanisms, including symmetric encryption and symmetric authentication processing. Used for such symmetry-based cryptographic services, sender and receiver of a message The author, or the author of a stored file, typically shares the same specific encryption/decryption key or the same specific authentication key, or one of them, with the reader. Access to such a key can be managed by a key manager that can include key splitting capabilities.

As described herein, key splitting typically involves splitting or decrypting a key into two or more parts, so that there is no part of itself that can be used to reconstruct the key. Instead, the various parts may need to be integrated to rebuild the key. Thus, the key splits to a data owner (hereinafter labeled U, or user U) to control such things as encryption, decryption, or authentication of the data by preventing other entities from determining the key or decryption program.

As for the key split, the data owner U can use a key manager (hereafter labeled P) to manage the keys for data protection. The data owner U can form a short-term data processing case that provides data protection (the specific i-th data processing case is labeled A _i ). For example, a short data processing case may represent the data owner U performing encryption or decryption of the data on a set of data, and then discarding the short data processing case. The Key Manager may not be able to trust the known key value.

In several embodiments, communication with the key manager P may use a partial homomorphic encryption technique, such as EIGamal encryption. EIGamal encryption technology is an asymmetric key cryptography for public key cryptography based on Diffie-Hellman key exchange. As for communicating with the Key Manager P, other types of encryption techniques can also be used.

As for the key split, the data owner U can form a master key (hereinafter referred to as K). The specific key used to manage the data object (ie, the portion of the material owned by the user) on behalf of the data owner can be derived from the primary key K. In order to process a specific key for an individual data item, the material owner U can initiate the formation of a short data processing case A _i and can send the primary key K encrypted under the public key of the key manager for data processing. Case A _i . The data processing case A _i can generate a random mask γ _i .

The data processing case A _i can use the isomorphic nature of an asymmetric key cryptography to combine the encryption of the random mask γ _{i with} the encryption of the primary key K. The isomorphic nature may refer to an encrypted form that allows for a particular type of operation on the ciphertext and produces an encrypted result that, when decrypted, matches the result of the operation on the original text used to generate the ciphertext. In this embodiment, the ciphertext generated by the combination of the encryption of the random mask γ _{i and} the encryption of the primary key K is the encryption of K*γ _i (that is, the product of K and γ _i ). The ciphertext of K and γ _i can be determined by a potential group structure including asymmetry key encryption method of the same type (for example, group G for EIGamal encryption). The data processing case A _i can send such a ciphertext to the key manager P. Moreover, the data processing case A _i can record the value of the random mask γ _i .

The random mask γ _i can be used as a mask shared by the key manager P with a short instantiation of the data processing case. The random mask γ _i can be shared implicitly, in that the key manager P does not know the value of the random mask γ _i . As such, the key manager P invokes the use of the random mask γ _i via its secret knowledge rather than explicit knowledge. The key manager P may use a key to decrypt the masked primary key (ie, the ciphertext of K and γ _i ) to obtain the value K*γ _i (ie, the product of K and γ _i ) And store this value for communication with the data processing case A _i .

The key used for encryption, decryption, and/or other authentication of individual data objects may be formed in the form α _j /K, where α _j is a random value such that the data processing case A _i knows the key while gold The key manager P knows α _j and stores α _j as a mask for this key. For example, the key manager may select a random value α _j and send α _j /(K*γ _i ) to the data processing case A _i that knows γ _i so that the data processing case can determine [α _j /(K) *γ _i )]*γ _{i is} used to reply α _j /K. These values relate to α _j , K , and γ _i , and all related operations can be performed on potential groups including homomorphic properties (eg, group G for EIGamal encryption). In the foregoing, a method for generating a description for a specific key of an individual data item may be used later to use the original mask for the present key α _j /K, and γ _i after the data processing case A _i no longer exists. The new value is used as a mask shared with this data processing case, allowing Key Manager P to provide a newly formed data processing case to reply to the key.

In accordance with an embodiment, a key splitting system and method for splitting a key are disclosed herein. As for the key splitting, the system and method can generally use any secure communication system without the need for homotype encryption technology. Non-limiting examples of secure communication systems may include systems that use secure asymmetric encryption techniques such as RSA, elliptic curve cryptography, and the like. Homotype encryption is generally described as an encrypted form that allows for a particular type of operation on a ciphertext and produces an encrypted result that, when decrypted, matches the result of performing an operation on the plaintext. The need to avoid using the same type of encryption technology can reduce the computational cost (for example, processing time, storage, energy utilization, etc.). For example, as with asymmetric key encryption methods that include homomorphic properties, the use of such techniques based on relatively long group elements (eg, 2048 bit lengths) can be computationally intensive, relatively relatively short bits. A metacharacter number (e.g., 128 or 256 bit length) that can be used with the systems and method examples disclosed herein.

For the systems and method examples disclosed herein, the random mask γ _i can be selected by the data owner (ie, the data owner U can select a random value for the mask γ _i ) such that asymmetric cryptography can be used for the key Split. As for the term "material owner U" as used herein, the information described by the data owner U and the information associated with the data owner U may be executed and correlated by the data owner computing device. In summary, for the systems and methods disclosed herein, the material owner U can select a random mask γ _i , encrypt γ _i *K under the key manager's public key, and send the plaintext along with the random mask. γ _i gives the data processing case A _i . The "*" symbol can represent any operation, such as XOR, multiplication, addition, and so on. The data processing case A _i records the random mask γ _i and the forward ciphertext to the key manager P, which can decrypt and record γ _i *K. As for the term key manager P as used herein, the information described by the key manager P and the information associated with the key manager P can be executed and correlated by the data owner computing device.

For the systems and method examples disclosed herein, the values K, γ _i , and α _j may be bit strings of appropriate length, with respect to a group of elements being fixed-length bit strings, bitwise XOR Group operation. The operations K*γ _i , α _j /K, etc. of the aforementioned key splitting service may be operations in this convenient group. The length of the key may be selected based on the cryptographic service of the management key (eg, details of encryption, decryption, or authentication methods).

For the system and method examples disclosed herein, the use of the same type of encryption technique is compared. Assuming that the key length of the secure symmetric key system is 256 bits, the XOR operation on the 256 bits is generally more efficient than the homogeneous encryption operation. For cryptanalysis techniques, these 256-bit values can be considered safe. As the power of computing increases (eg, in accordance with Moore's Law, etc.) and as cryptanalysis improves, the length of such bits can grow slowly. It is expected that the symmetry key length will continue to be relatively shorter than the asymmetric key length. Moreover, for the systems and method examples disclosed herein, the need to convert the group element α _j /K into a useful symmetry key is also eliminated, since the value can be used directly as a bit string. For example, for a group of elements having a fixed length bit string, the bitwise XOR is used as a group operation, and the values K and α _j may be bit strings of an appropriate length.

According to an embodiment, a key splitting system can include at least one processor and a memory storage machine readable instruction that, when executed by the at least one processor, causes the at least one processor to be self-contained (eg, data owned) U) receives a master key K associated with the material to be encrypted, decrypted, or authenticated. A data key _Sj used to encrypt, decrypt, or authenticate the material can be derived from the primary key K and a mask γ _i received from the entity associated with the data. The machine readable command can further forward a version (eg, K*γ _i ) that is masked by the master key using the mask to the key manager P for managing the data key S _j and generating a data processing Case _{Ai is} used to encrypt, decrypt, or authenticate the data using the data key. Such machine-readable instructions may further define the data keys S _j used by data processing based on the case A _i a previously selected key information (e.g., a known S _j) and encryption, decryption, or the authentication information.

1 illustrates the architecture of a key splitting system 100 (hereinafter also referred to as "system 100") in accordance with one embodiment of the present disclosure. Referring to Figures 1 and 2, system 100 is depicted as including an example of a data processing case generation module 102 for generating a data processing case 104, the i-th example of which is labeled _Ai . The data processing case generation module 102 can implement a data processing case generation agreement 200, as described herein with reference to FIG. The data processing case A _i can be instantiated by means of a data owner 106 (labeled U) having a master key 108 (labeled K) and a virtual key management module 110 (labeled P) ). The data owner U may also select a random mask 122 (labeled γ _i ) to generate a masked version of the primary key K, as described herein with reference to the data processing case generation protocol 200. The virtual key management module P, which may be separate from the system containing the data owner U, or it may be in the same system as the data owner U, may assist in the different encryption key cross-data processing cases 104 _Illustrate the maintenance of A _i . For the data processing case generation agreement 200, communication may not be required between the data owner U and the virtual key management module P.

In order to retrieve the decrypted material from a data repository 112 that includes the data 114, the material owner U can initiate a data processing case _Ai . The data processing case A _i can be short-lived. The data processing case A _i can be used to interact with the virtual key management module P to reconstruct a particular key. The state of the different instantiations of the data processing case A _i can be maintained by the material owner U using the same master key K in all the instants A _i , and the specific key S _j *K is stored by the virtual key management module P ( Where S _j represents a string representing one of the j-th specific keys used to encrypt, decrypt, or authenticate, or verify the authenticity of a data item, is maintained by a masked version.

A data repository key generation module 116 of the system 100 can generate a new specific key _Sj for encrypting, decrypting, or authenticating, or verifying the authenticity of the material 114 on the data repository 112. The data repository key generation module 116 may be embodied by the material owner U and/or by the virtual key management module P, but shown as being implemented independently in the example of the system 100 of FIG. As described herein with reference to FIG. 3, the data repository key generation module 116 can implement a data repository key generation protocol 300. The data repository key generation module 116 can provide for the storage and use of the blind key (i.e., masked) version of the particular key _Sj by the virtual key management module P.

A data processing case key generation module 118 of the system 100 can provide the data processing case 104 for dynamically generating a specific key S _j and transmitting a blind version of the generated key to the virtual key management module P. The data processing case key generation module 118 may be embodied by the material owner U and/or by the virtual key management module P, but shown as being implemented independently in the example of the system 100 of FIG. As described herein with reference to FIG. 4, the data processing case key generation module 118 can implement a data processing case key generation agreement 400.

The previously stored item retrieval module 120 of one of the systems 100 can be embodied to retrieve a previously stored item from the data repository 112. The previously stored item retrieval module 120 may be embodied by the material owner U and/or by the virtual key management module P, but shown as being implemented independently in the example of the system 100 of FIG. As described herein with reference to FIG. 5, the prior stored item retrieval module 120 can implement a prior stored item retrieval protocol.

For the system 100, different entities can be secured between them by using, for example, a Secure Sockets Layer (SSL) or Transport Layer Security (TLS) built on a Public Key Infrastructure (PKI). Communication. Referring to Figures 1-5, the key and mask elements K, S _j , α _{j ,} etc. may be bit-strings of appropriate length (i.e., bits-characters for cryptographic key processing, their keys) It is managed by using the key split protocol of system 100, and "+" can be used for mutual exclusion or (XOR).

Figure 2 illustrates one embodiment according to embodiments disclosed herein, data processing for generating a data Cases Cases A _i flowchart 200 of generating agreement. Although the execution of the method described below is described with reference to system 100 of Figure 1, it will be apparent to those skilled in the art that other devices are suitable for performing such methods. The method described in the flowchart of FIG. 2 and the methods described in other figures may be stored in a machine readable storage medium, such as the memory 806 of FIG. 8 and/or the secondary data storage device 808, executable instructions thereon. The form is embodied by one or more of the modules described herein, and/or embodied in the form of electronic circuitry.

Referring to FIG. 2, at block 202, the material owner U can randomly select the primary key K (ie, select a random value for the primary key K). In addition, the material owner U can retrieve the primary key K from one of the previously generated keys.

At block 204, the data owner U may select a random mask γ _i (ie, select a random value for the mask γ _i ).

At block 206, the material owner U may send the primary key K mutually exclusive or random mask γ _i (ie, K+γ _i ) to the virtual key management module P. In other words, the material owner U can send a random mask γ _{i in the} form of a mask to the virtual key management module P. The primary key K can also be selected by the data owner U who owns the data 114.

At block 208, the material owner U can send a random mask γ _i to the data processing case A _i .

At block 210, the virtual key management module P may store the primary key K mutually exclusive or random mask γ _i (ie, K+γ _i ). In other words, the virtual key management module P can store the random mask γ _i masked by K, where K+γ _i is determined by bitwise exclusive or operation. As for the system 100, the non-transitory storage medium can be coupled to the virtual key management module P for storing any information related to the virtual key management module P (eg, K+γ _i , α _{j ,} etc.).

At block 212, the data processing case A _i can store the random mask γ _i . The random mask γ _i can be briefly exemplified by the corresponding data processing case A _i for data object encryption, decryption, or authentication, or authenticity verification related operations. With respect to system 100, a non-transitory storage medium can be coupled to a material owner U for storing any information (eg, γ _i , S _{j ,} etc.) associated with the user and the data processing case A _i .

As for data processing agreement to produce 200 cases, in terms of data processing Case A _i master key K secrecy may by used to be asymmetric encryption technology to ensure. As far as the virtual key management module P is concerned, the secrecy of the primary key K can be randomly selected based on the mask, rather than being ensured by the virtual key management module P.

3 illustrates a flow diagram of the data repository key generation agreement 300 in accordance with one embodiment disclosed herein. Based on the setting of the specific case mask K+γ _i of the primary key K, this particular case mask can be used to protect the particular key S _j used to store the encryption, decryption, or authentication, or authenticity verification of the object. This can be done by interacting the data processing case _Ai with the virtual key management module P, where the virtual key management module P can store blind versions of various specific keys. The data repository key generation agreement 300 can provide the jth specific key _{Sj for} unrelated instantiation access by subsequent data processing cases.

Referring to Figure 3, at block 302, generates a master key K 200 for the protocol data block A _i of Cases 210 and 212, P virtual key management module may retrieve or otherwise receive the stored data based on Cases A mutually exclusive or random mask γ _i (ie, K+ γ _i ) is taken as input, and the data processing case A _i can retrieve or otherwise receive the stored random mask γ _i as an input.

At block 304, the data processing case A _i may forward a request to the virtual key management module P for generating a new key having an index j. As described herein, a new key having an index j can be determined based on a random selection made by the virtual key management module P.

At block 306, the virtual key management module P can randomly select α _j and determine β _ij =α _j XOR(K XOR γ _i ) (ie, β _ij =α _j +(K+γ _i )). For block 306, α _j and β _ij may represent masks for blind use.

At block 308, the virtual key management module P can send β _ij to the data processing case A _i .

At block 310, the data processing case A _i may determine that the jth particular key S _j is β _ij XOR γ _i (which is equal to α _j XOR K).

At block 312, the data processing case A _{i may} store the jth particular key S _j .

At block 314, the virtual key management module P may store α _j (which is equal to S _j XOR K).

As for the data repository key generation agreement 300, the character string S _j output by the material processing case A _i may represent the j-th specific key S _j . In several embodiments, instead of directly using the key data for processing S _j, it can be fed into key S _j to a derivative of the function key (KDF) as an input, an output processing system with a data key. In this way, the related key attack on the data stored by the virtual key management module P can be avoided, where the data includes K+S ₁ , K+S ₂ , ..., K+S _{j ,} etc. Value.

4 illustrates a flow diagram of the data processing case key generation agreement 400 in accordance with one embodiment disclosed herein.

Referring to Figure 4, at block 402, the block 210 generates agreement 200 and 212 based on the data processing for the case A _i data processing cases, the key management module of the virtual P may retrieve or otherwise receive the stored master key K mutexes or random mask γ _i (ie, K+ γ _i ) as input, and data processing case A _i may retrieve or otherwise receive the stored random mask γ _i as input.

At block 404, the data processing case _Ai may forward a request to the virtual key management module P for a new key having an index j. As described herein, it has a new key index j may be determined according to the data processing done randomly selected cases of A _i.

At block 406, the data processing case A _i may randomly select the jth particular key S _j and determine β _ij =S _j XOR γ _i , (ie, β _ij =S _j +γ _i ).

At block 408, the data processing case A _i can be _forwarded to the virtual key management module P.

At block 410, the virtual key management module P may determine that α _j is β _ij XOR(K XOR γ _i ) (ie, α _j =β _ij +(K+γ _i )).

At block 412, the data processing case A _{i may} store the jth particular key S _j .

At block 414, the virtual key management module P may store α _j (which is equal to S _j XOR K).

As for the data processing case key generation agreement 400, the character string S _j output by the material processing case A _i may represent the jth specific key S _j . In several embodiments, instead of directly using the key S _j for processing data, the key can be fed to a KDF S _j as an input, an output data processing system is used as a key. In this way, the related key attack on the data stored by the virtual key management module P can be avoided, where the data includes K+S ₁ , K+S ₂ , ..., K+S _{j ,} etc. Value.

5 illustrates a flow diagram of a prior stored item retrieval protocol 500 for retrieving a previous (ie, older) stored item from data repository 112 in accordance with an embodiment of the present disclosure.

At block 502, the block 210 generates agreement 200 and 212 based on the data processing for the case A _i data processing cases, P virtual key management module may retrieve or otherwise receive the stored master key K exclusive or The random mask γ _i (ie, K+ γ _i ) is taken as input, and the data processing case A _i can retrieve or otherwise receive the stored random mask γ _i as an input.

At block 504, the virtual key management module P may retrieve or otherwise receive α _j as input, where the α _j estimate is generated by a previous illustration of one of the data processing cases labeled A _i '.

At block 506, the data processing case _Ai may forward a request to the virtual key management module P to request a previously generated key having an index j. As described herein, having a key previously generated index j may be determined according to a random selection by the data processing of the case A _i.

At block 508, the virtual key management module P may retrieve α _j and determine β _ij =α _j XOR(K XOR γ _i ) (ie, β _ij =α _j +(K+γ _i )).

At block 510, the virtual key management module P can forward β _ij to the data processing case A _i .

At block 512, the data processing case A _i may determine that the jth particular key S _j is β _ij XOR γ _i , (ie, S _j =β _ij +γ _i ).

At block 514, the data processing case A _{i may} store the jth particular key S _j . In several embodiments, instead of directly using the key S _j for processing the material, the key S _j can be fed to a KDF as an input and its output used as a data processing key. In this way, the related key attack on the data stored by the virtual key management module P can be avoided, where the data includes K+S ₁ , K+S ₂ , ..., K+S _{j ,} etc. Value.

As for the data repository key generation agreement 300, the data processing case key generation agreement 400, and the previously stored item retrieval protocol 500, the specific key S _j can be used to derive a plurality of keys for a collection of the data 114 Each data item in the object has a key. Each of the derived keys can be symmetric or asymmetrical. According to the specific key S _j , the derived key can be determined to form a hierarchical structure or a tree structure. For example, in the case of a Trusted Platform Module (TPM), which is an international standard for secure cryptographic processors, for example, a key hierarchy relationship in which each node (in the tree) can include two keys, one for symmetry and The other is asymmetry.

The modules and other components of system 100 can be machine readable instructions stored on non-transitory computer readable media. In this regard, system 100 can include or can be a non-transitory computer readable medium. Additionally or alternatively, the modules and other components of system 100 can be a combination of hardware or machine readable instructions and hardware.

FIG. 6 and FIG. 7 are respectively an example of a corresponding key splitting system 100, and the composition thereof is described in detail later, and the method 600 and 700 for splitting the key is performed. Cheng Tu. The methods 600 and 700 can be embodied in the key splitting system 100 with reference to Figures 1-5, by way of example and not limitation. Methods 600 and 700 can be implemented in other systems.

Referring to Figure 6, for method 600, at block 602, the method can include generating a master key. For example, referring to Figures 1 and 2, at block 202, the material owner U can generate a primary key K.

At block 604, the method can include generating a random mask. For example, referring to Figures 1 and 2, at block 204, the material owner U can generate a random mask γ _i (i.e., generate a random value for masking γ _i ).

At block 606, the method can include generating a masked version of the primary key by using the random mask. For example, referring to FIG. 1 and FIG. 2, the material owner U may generate a primary key K mutually exclusive or random mask γ _i (ie, K+γ _i ).

At block 608, the method can include pre-passing the masked version of the primary key to a key manager. For example, referring to FIG. 1 and FIG. 2, at block 206, the material owner U may generate a primary key K mutually exclusive or random mask γ _i (ie, K+γ _i ) to the virtual key management module P.

At block 610, in response to forwarding the masked version of the primary key, the method can include receiving a new mask from the key manager. For example, referring to FIGS. 1-3, at block 308, the data processing case A _i can receive β _ij from the virtual key management module P _i .

At block 612, the method can include determining a data key based on the new mask and the random mask. For example, referring to FIGS. 1-3, at block 310, the data processing case A _i may determine that the jth particular key S _j is β _ij XOR γ _i (which is equal to α _j XOR K).

In accordance with an embodiment, for method 600, generating a masked version can include using a mutex or addition, or multiplication operation to generate a masked version of the master key (e.g., with reference to block 206 of FIG. 2).

According to an embodiment, for method 600, determining a data key based on a new mask and a random mask may include determining a data key based on a mutual exclusion or operation between the new mask and the random mask (eg, referring to the block of FIG. 3) 310).

According to an embodiment, for method 600, the new mask may be based on a random selection of another mask (eg, α _j ) by the key manager and a masked version of the master key (eg, refer to the block of FIG. 3 306).

According to an embodiment, the method 600 can further include generating a data processing case for encrypting, decrypting, or authenticating the data using the data key. For example, referring to FIG. 1, the data processing case generation module 102 can generate an example i of the data processing case 104, and the ith example of the data processing case 104 is labeled A _i .

According to an embodiment, for the method 600, generating the data processing case may further include generating a short-term illustration of the data processing case for encrypting, decrypting, or authenticating the data by using the random mask and the data key, and Another short-lived illustration of the data processing case is to encrypt, decrypt, or authenticate additional data using another random mask and another data key.

According to an embodiment, for the method 600, the data may include a set of data objects, and the method 600 may further include using the data key to derive a plurality of data keys, where the plurality of data keys are Each data key in the pair corresponds to one of the data items in the data object. For example words, with reference to FIGS. 1-5, the information repository 300 key generation protocol, data processing is generated key agreement 400 cases, and previously stored objects retrieved agreement 500, the particular key may be used to derive a plurality of S _j gold The key, where each of the plurality of data keys corresponds to one of the data items in the data object to be aggregated.

Referring to FIG. 7, for method 700, at block 702, the method can include generating a master key for an entity associated with the material. For example, referring to Figures 1 and 2, at block 202, the material owner U can generate a primary key K.

At block 704, the method can include generating a mask on an entity associated with the data. For example, referring to Figures 1 and 2, at block 204, the material owner U can generate a mask γ _i .

At block 706, the method can include generating a masked version of the one of the master keys by using the mask. For example, referring to FIG. 1 and FIG. 2, the material owner U may generate the primary key K to mutually exclusive or mask γ _i (ie, K+γ _i ).

At block 708, the method can include forwarding the masked version of the primary key to a key manager. For example, referring to FIG. 1 and FIG. 2, the data owner U can forward the master key K to mutually exclusive or mask γ _i (ie, K+γ _i ) to the virtual key management module P.

At block 710, the method can include receiving a new mask from the key manager, where the new mask is associated with a prior data key. For example, referring to Figures 1, 2, and 5, at block 510, the data processing case A _i can receive β _ij from the virtual key management module P, where β _ij is associated with the previous data key S _j .

At block 712, the method can include determining the prior data key based on the new mask and the mask generated by the entity associated with the material. For example, referring to Figures 1, 2, and 5, at block 512, the data processing case A _i may determine that the jth particular key S _j is β _ij mutually exclusive or γ _i (ie, S _j = β _ij + γ _i ).

According to an embodiment, for the method 700, the data may include a set of data objects, and the method 700 may further include using the previous data key to derive a plurality of data keys, where the plurality of data keys are Each data key in the pair corresponds to one of the data items in the data object. For example words, with reference to FIGS. 1-5, the information repository 300 key generation protocol, data processing is generated key agreement 400 cases, and previously stored objects retrieved agreement 500, the particular key may be used to derive a plurality of S _j gold The key, where each of the plurality of data keys corresponds to one of the data items in the data object to be aggregated.

According to an embodiment, the method 700 can further include generating a data processing case for encrypting, decrypting, or authenticating the data using the data key. For example, referring to FIG. 1, the data processing case generation module 102 can generate an example i of the data processing case 104, and the ith example of the data processing case 104 is labeled A _i .

In accordance with an embodiment, for method 700, generating the mask for the data-related entity can further include generating a random mask for the entity associated with the material. For example, referring to Figures 1 and 2, at block 204, the material owner U can generate a random mask γ _i (i.e., generate a random value for the mask γ _i ).

According to an embodiment, for method 700, the data can include an index. The new mask can be associated with the previous data key by the index of the material. For example, referring to Figures 1, 2, and 5, at block 506, the data processing case A _i may forward a request to the virtual key management module P for requesting the previously generated key having the index j (ie, The index of the information). The new mask β _ij can be related to the previous data key S _j by the index j of the material.

According to another embodiment of the key splitting method, the key splitting may include receiving a masked version of the primary key K (eg, K+γ _i ) (eg, referring to block 206 of FIG. 2). The master key K may be masked by a mask γ _i generated by the data-related entity (e.g., the material owner U) (e.g., referring to block 204 of FIG. 2). The key splitting may further comprise receiving a new mask β _ij based on the selection of the previous data key S _j and further based on the mask γ _i generated in the data-related entity (eg, reference to block 406 of FIG. 4) And 408). A further new mask α _j may be determined according to the new mask β _ij , which is based on the selection of the previous data key S _j and its masked version according to the master key (for example, refer to block 410 of FIG. 4 ). According to an embodiment, the new mask may be randomly selected based on the previous data key _Sj (e.g., reference to block 406 of FIG. 4). According to an embodiment, yet another new mask may be determined based on an XOR operation between the new mask β _ij and the masked version of the master key (eg, K+γ _i ) (eg, refer to block 410 of FIG. 4).

FIG. 8 shows a computer system 800 that can be used in conjunction with the examples described herein. Computer system 800 can represent a general purpose platform that includes components that can be located in a server or another computer system. Computer system 800 can be used as a platform for system 100. Computer system 800 can perform the methods, functions, and other processes described herein by a processor (e.g., single or multiple processors) or other hardware processing circuitry. The methods, functions, and other processes can be implemented as machine readable instructions stored on a computer readable medium, which can be non-transitory, Such as hardware storage devices (for example, random access memory (RAM), read only memory (ROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), hardware drive And flash memory).

Computer system 800 can include a processor 802 that can implement or execute machine readable instructions to perform some or all of the methods, functions, and other processes described herein. Instructions and data from processor 802 can be communicated via communication bus 804. The computer system can also include a main memory 806, such as random access memory (RAM), during which the machine readable instructions and data of the processor 802 can reside, and a secondary data storage device 808, It can be non-electrical and storage machine readable instructions and data. Memory and data storage devices are examples of computer readable media. The memory 806 can include a key splitting module 820 that includes machine readable instructions that reside in the memory 806 and are executable by the processor 802 during execution time. The key splitting module 820 can include the modules of the system 100 shown in FIG.

Computer system 800 can include an I/O device 810 such as a keyboard, mouse, display, and the like. The computer system can include a network interface 812 for connecting to the network. Other known electronic components in a computer system can be added or replaced.

The foregoing disclosure discloses multiple instances of key splitting. The disclosed examples can include systems, devices, computer readable storage media, and methods for key splitting. For purposes of explanation, some examples are described with reference to the components illustrated in Figures 1-8. However, the functions of the illustrated components may overlap and may exist in a few or more components or components. Also, all or a portion of the functions of the illustrated elements may be co-located or distributed across several geographically dispersed locations. Furthermore, The disclosed examples can be implemented in various environments and are not limited to the illustrated examples.

Again, the order of operations described in relation to Figures 1-8 is an example and is not intended to be limiting. Additional or fewer operations or combinations of operations may be utilized or may be employed without departing from the scope of the disclosed examples. Again, the specific embodiments consistent with the disclosed examples need not be performed in any particular order. Thus, the disclosure herein is merely illustrative of possible embodiments of the specific embodiments, and many variations and modifications can be made to the examples described. All such changes and modifications are intended to be included within the scope of the disclosure and are protected by the following claims.

100‧‧‧ system

102‧‧‧Data processing case generation module

104‧‧‧Data processing case

106‧‧‧ Data owner

108‧‧‧Master Key

110‧‧‧Virtual Key Management Module

112‧‧‧Data repository

114‧‧‧Information

116‧‧‧Data Repository Key Generation Module

118‧‧‧ Data Processing Case Key Generation Module

120‧‧‧Previous storage item retrieval module

122‧‧‧ Random mask

Claims (15)

A non-transitory computer readable medium having stored thereon machine readable instructions for providing key splitting, the machine readable instructions, when executed, causing at least one processor to: generate a master key; generating a random mask; by using the random mask to generate a masked version of the primary key; pre-passing the masked version of the primary key to a key manager; in response to forwarding the primary key The masked version receives a new mask from the key manager; and determines a data key based on the new mask and the random mask. The non-transitory computer readable medium of claim 1, wherein the machine readable instructions for generating the masked version of the primary key comprise instructions for: using a mutually exclusive or (XOR), One of the additions, and one of the multipliers to produce the masked version of the primary key. The non-transitory computer readable medium of claim 1, wherein the machine readable instructions for determining the data key based on the new mask and the random mask include instructions for: based on the new mask The data key is determined by a mutually exclusive or (XOR) operation between the mask and the random mask. The non-transitory computer readable medium of claim 1 wherein the new mask is A random selection of the mask by the key manager and the masked version of the master key. The non-transitory computer readable medium of claim 1 further comprising machine readable instructions for generating a data processing instance to encrypt, decrypt, or authenticate the data using the data key. The non-transitory computer readable medium of claim 5, wherein the machine readable instructions for generating the data processing case include instructions for generating a short instantiation of the data processing case to apply the random mask And encrypting, decrypting, or authenticating the data with the data key; and using another short instance of a data processing case to encrypt, decrypt, or authenticate further data using another random mask and another data key. The non-transitory computer readable medium of claim 1, wherein the data comprises a set of data objects, and wherein the machine readable instructions further comprise instructions for: using the data key to derive a plurality of data items a key, wherein each of the plurality of data keys corresponds to a different item in the data item of the set. A key splitting system comprising: at least one processor; and a memory storage machine readable instruction that, when executed by the at least one processor, causes the at least one processor to: receive a mask of a master key Cover version, where the primary key Is masked by using a mask generated by an entity associated with the material; receiving a new mask based on the selection of a prior data key and further based on the entity associated with the material The mask is generated; and a new mask is determined based on the new mask based on the selection of the prior data key and based on the masked version of the master key. The key splitting system of claim 8, wherein the new mask is randomly selected based on one of the prior data keys. The key splitting system of claim 8, wherein the machine readable instructions to determine the further new mask further cause the at least one processor to: based on the new mask and the primary key The further new mask is determined by a mutually exclusive or (XOR) operation between the mask versions. A method for splitting a key, the method comprising: generating, by a computer system including a physical processor, a master key in an entity associated with the material; and the computer system including the physical processor, The entity associated with the material creates a mask; the computer system comprising the physical processor generates a masked version of the master key by using the mask; the computer system comprising the physical processor, Forwarding the masked version of the master key to a key manager; Receiving, by the computer system comprising the physical processor, a new mask from the key manager, wherein the new mask is associated with a prior data key; and the computer system comprising the physical processor is based on The new mask and the mask generated by the entity associated with the material determine the prior data key. The method of claim 11, wherein the material comprises a set of data objects, and wherein the method further comprises: using the prior data key to derive a plurality of data keys from the computer system including the physical processor, Each of the plurality of data keys corresponds to one of the data items in the data object to be aggregated. The method of claim 11, further comprising: generating, by the computer system comprising the physical processor, a data processing case to encrypt, decrypt, or authenticate the data using the data key. The method of claim 11, wherein the generating the mask in the entity associated with the material further comprises: generating, by the computer system comprising the physical processor, a random mask on the entity associated with the material. The method of claim 11, wherein the material comprises an index, and wherein the new mask is associated with the prior data key by the index of the material.